kritisch
GHSA-mgc4-wqv7-4pxm
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut GHSA.
Beschreibung
### Impact Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues. This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module. ### Workarounds No workaround is available, users must upgrade. ### References https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| cocoapods::GitHub Security Advisory Swift | CNIOAtomics, CNIODarwin, CNIOHTTPParser und 29 weitere | 1.14.2, 2.13.1 |
| swift::GitHub Security Advisory Swift | github.com/apple/swift-nio | 1.14.2, 2.13.1 |
Alle 33 Einträge aus 2 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| cocoapods::GitHub Security Advisory Swift | CNIOAtomics | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIODarwin | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOHTTPParser | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOLinux | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOSHA1 | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOWindows | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | CNIOZlib | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | NIOConcurrencyHelpers | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIO | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOChatClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOChatServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOConcurrencyHelpers | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOCore | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEchoClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEchoServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOEmbedded | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOFoundationCompat | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1 | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1Client | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOHTTP1Server | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOMulticastChat | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOPerformanceTester | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOPosix | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOTLS | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOTestUtils | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOUDPEchoClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOUDPEchoServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocket | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocketClient | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | SwiftNIOWebSocketServer | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | _NIOConcurrency | 1.14.2, 2.13.1 |
| cocoapods::GitHub Security Advisory Swift | _NIODataStructures | 1.14.2, 2.13.1 |
| swift::GitHub Security Advisory Swift | github.com/apple/swift-nio | 1.14.2, 2.13.1 |
Referenzen
- https://github.com/apple/swift-nio
- https://github.com/apple/swift-nio/commit/8da5c5a4e6c5084c296b9f39dc54f00be146e0fa
- https://github.com/apple/swift-nio/commit/bfde40cac8eca25ce021552513b20ee23fc6e306
- https://github.com/apple/swift-nio/commit/df9390006bce7da1b6273f804d3acbbfdfcc6154
- https://github.com/apple/swift-nio/commit/f94b22b506e3557cb1b325534fa9bbcd39c90246
- https://github.com/apple/swift-nio/pull/1387
- https://github.com/apple/swift-nio/pull/1388
- https://github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm